Recovery Time Objective (RTO) vs Recovery Point Objective (RPO)

RTO and RPO refer to different targets in a business continuity plan – the book you break out when something has gone seriously wrong and the very existence of your organization is in question. But what are they, exactly? And how do they differ?

RTO stands for recovery time objective. It is the duration of time it takes between a serious failure occurring and the resumption of your business operations. It’s called an objective because it is a target – you hope to be back up and running by the RTO.

By comparison, RPO stands for recovery point objective. This is the maximum amount of time covered by your backups. If your RTO is one month, you could restore your data from any point between your most recent backup and one month ago.

This flexibility is important as you might not be sure how far back you have to go to find uncorrupted data. If you only discover that you’ve been hacked three months after it happened, you better hope your RPO is further back than that. If you’re recovering from a natural disaster, at least, you usually know right away. 

So, on some levels, the recovery time objective vs recovery point objective debate is more about how far back your backups go (RPO) vs how long it takes you to restore it all (RTO). 

How do you assess the necessary recovery time for your business? This should be the RTO in your recovery plan. The biggest factor is probably how much downtime costs your business. Service level agreements (SLAs) in place with your customers or clients could be a big part of that calculation, as could the amount of reputation loss or customer dissatisfaction your downtime would cause. In the end, all of this can be measured in dollars.

A small, local business would be able to weather downtime longer and with fewer consequences than could a company like Google. The world’s largest search engine would stand to lose exponentially more the longer their downtime persists than would the little shop around the corner. 

In short, it is all dependent on your business and how much downtime you’re willing to contemplate. 

So, how do you determine how much data loss you can afford in a disaster situation? Well, there will be several factors, and you’ll have to weigh them in terms of your own organization. 

Consider how much it would cost to implement a recovery solution that offers total protection, one that offers enough protection for you to feel reasonably safe, and one that barely covers the minimums. 

Now, compare the cost of each of those plans to the cost of re-entering all of your lost data, the cost of recollecting or rebuilding any data that was truly lost, the maximum amount of such loss your business can withstand without dissolving, and how much new data will be lost (or how much you will fail to capture) while your operations are paused or halted. 

What should you include in your plans? Maximizing one objective doesn’t always mean compromising the other. Some business continuity plans don’t see recovery time objective and recovery point objective as in opposition at all. 

A good backup solution is the heart of your disaster recovery plan, but other aspects can be equally or even more important, depending on your business type and recovery strategy. 

Backups make copies (ideally, well-protected offsite copies) of all of your crucial data. Disaster recovery makes use of those backups to rebuild your operations if something really terrible happens.  

How do you create a sustainable plan for preventing downtime? This is one place where you might have to balance recovery time objective vs recovery point objective values against each other. However, a good plan will make enough room for both. 

There are a number of best practices you can execute to ensure the greatest possible outcome for your business:

• Plan ahead to make sure you know how you will rebuild after all sorts and scales of disasters. 
• Make sure your backups, hardware, security, and even personnel procedures are up to date and fit for purpose. 
• Keep your workforce up to speed with your business continuity plans. 
• Back up more than your data – install an independent backup power system if you have the resources. 
• Test your recovery infrastructure regularly to make sure it is actually protecting you. 

Remember, recovery time objective vs recovery point objective doesn’t describe a true dichotomy. You can easily have both in the same plan. In fact, you really should. And improving one should not mean downgrading the other. 

Consider whether it might be better to seek a business continuity, disaster recovery, or data backup provider. It could be that a company such as Liquid Web may be a better, more cost-effective solution than your in-house team.